Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(wakatime): incorrect sha256 checksum #181155

Merged
merged 1 commit into from
Jul 31, 2024
Merged

Conversation

Zach677
Copy link
Contributor

@Zach677 Zach677 commented Jul 31, 2024

Important: Do not tick a checkbox if you haven’t performed its action. Honesty is indispensable for a smooth review process.

In the following questions <cask> is the token of the cask you're submitting.

After making any changes to a cask, existing or new, verify:

Additionally, if adding a new cask:

  • Named the cask according to the token reference.
  • Checked the cask was not already refused (add your cask's name to the end of the search field).
  • brew audit --cask --new <cask> worked successfully.
  • HOMEBREW_NO_INSTALL_FROM_API=1 brew install --cask <cask> worked successfully.
  • brew uninstall --cask <cask> worked successfully.

The sha256 checksum for the wakatime cask seems to be incorrect. I tried installing the cask using brew install wakatime and got

Error: wakatime: SHA256 mismatch
Expected: b7172d260d2cb39d49afced2703d9ea1f31a77c9fe65484df0e7f099a1853a26
  Actual: 1749e4bc7b68a0da7635cc09b390b1950b8935d1e0fae5d6149fd86e33209d5d

I downloaded the cask for (https://github.com/wakatime/macos-wakatime/releases/download/v5.17.0/macos-wakatime.zip) manually and checked the sha256 with shasum -a 256. The values were indeed different, and in the case of arm (which I use) showed the checksum listed above in "Actual".

I understand that updating version & checksum is a task usually performed by a bot (see 401bb55), but in this case something went wrong and brew users cannot install the update. I also understand that changing the checksums opens up the possibility of getting insecure code onto users' machines, but since the source is not changed, I see no harm.

@Zach677 Zach677 changed the title fix: wakatime sha256 error fix(wakatime): incorrect sha256 checksum Jul 31, 2024
Copy link
Member

@khipp khipp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, @Ssttar! It seems like upstream reran the workflow for version v5.17.0 to include a fix for Intel CPUs:

The cask was bumped after the first run, explaining the checksum mismatch.

@khipp khipp merged commit 32e69e1 into Homebrew:master Jul 31, 2024
8 checks passed
@Zach677 Zach677 deleted the patch-1 branch August 6, 2024 11:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants